CVE-2026-25542

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Published

Apr 21, 2026, 4:05:43 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.26% · Oct 27, 2026

A flaw was found in Tekton Pipelines. An attacker can bypass trusted resource verification policies by crafting a malicious source string that contains a trusted pattern as a substring. This is due to the `regexp.MatchString` function in Go matching patterns anywhere within a string, rather than requiring an exact match. This vulnerability can lead to unintended policy matches, allowing an attacker to alter verification modes or keys and potentially compromise the integrity of Continuous Integration/Continuous Delivery (CI/CD) pipelines. github.com/tektoncd/pipeline: Tekton Pipelines: Security bypass due to regular expression matching flaw A Moderate security bypass flaw exists in Tekton Pipelines, impacting Red Hat products utilizing Tekton for CI/CD operations. An attacker can bypass trusted resource verification policies by crafting a malicious source string that exploits the `regexp.MatchString` function's behavior of matching patterns anywhere within a string. This can lead to unintended policy matches, potentially compromising the integrity of CI/CD pipelines in affected OpenShift Virtualization, Konflux, OpenShift Builds, Hosted OpenShift Clusters, OpenShift Pipelines, Red Hat OpenShift AI, Red Hat Trusted Artifact Signer, and OpenShift Serverless deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.